Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Successful data recovery of broken eMMC chip MCU1

Banjo

Member
Mar 18, 2018
45
11
USA
Yes, I know that possibility for EU citizens.

Banjo, did Micro-com tell you to have experiences with the similar situation (p3 contains only zeros) and still had managed to recover the keys from the chip?

They told me they thought it would be fine. They still haven't received my chip. Mail has been understandably slower, especially internationally, since Covid19 hit.
 

brook90

Member
Sep 7, 2019
42
70
UK
Could I ask a really simple basic question - I thought I knew the answer but have now read so much online I’ve confused myself. Have an easyjtag plus box with 1-bit ISP adaptor but need to use an external regulated bench PSU to power the eMMC on the Tegra board (as it only seems to be 2.6V at the board using the ISP’s power).

The bench PSU has +ve, -ve and GND terminals - do I connect the ISP’s D0, CMD and CLK points to the relevant pads on the Tegra, along with +ve from the PSU (to the 2.8V pad), and then connect -ve on the PSU, GND on the PSU, GND pad on the board and GND on the ISP all together?
 

psyched

Member
Apr 27, 2019
21
19
JP
The bench PSU has +ve, -ve and GND terminals - do I connect the ISP’s D0, CMD and CLK points to the relevant pads on the Tegra, along with +ve from the PSU (to the 2.8V pad), and then connect -ve on the PSU, GND on the PSU, GND pad on the board and GND on the ISP all together?

If you don't know your equipment you should check with voltage meter before.
I would expect the adjusted voltage between V+ and V-, on most PSU's GND is earth and suitable to connect your antistatic mat/wristband - so you can forget GND and interconnect V-.
 
  • Informative
Reactions: brook90

jtornqv

Member
Mar 28, 2020
6
1
Sweden
I was able to find the correct firmwares for the MCU i have been working on, however i clumsily damaged the connector for the touch panel (at least i believe it is for the touch panel) during disassembly of the MCU. The main board was damaged quite badly (all traces to the connector torn from the board), and i deemed it unrepairable, at least in a reliable manner.
Since i was unable to recover the VPN keys anyway, the owner opted to have the MCU replaced by tesla.
Thanks for all the help and input!
 

brook90

Member
Sep 7, 2019
42
70
UK
If you don't know your equipment you should check with voltage meter before.
I would expect the adjusted voltage between V+ and V-, on most PSU's GND is earth and suitable to connect your antistatic mat/wristband - so you can forget GND and interconnect V-.
Many thanks - have now tried every which way but can't get the easyjtag plus with ISP to read the emmc, CMD timeout error continously. I know @LuckyLuke has got it to work with this hardware (and has been really helpful in trying to diagnose the issue for me) - has anybody else and is willing to share their setup? @Slexs, or did you end up using something else?
 

StarLog

Member
Supporting Member
Mar 11, 2019
458
209
MCO
Found this cheaper on ebay.

Tesla Service Cable Ethernet FakraHSD for Toolbox 2.0ft Model S/X | eBay

$_0.JPG
 

whitex

Well-Known Member
Sep 30, 2015
6,825
8,671
Seattle area, WA
Tried the MCU with p1 and p2 restored and p3 and p4 empty save for apn-file and folders. MCU did not start up, tried the steering wheel reboot methods a couple of times. Desoldered the new emmc again today to verify i didn't damage it while soldering it. It was fine. Read the syslog file created on p3 which contained over a million lines of squashfs read errors. Turns out that p1/p2 wasn't ok after all. Unsquashfs confirms that they are toast (i should have tried this before..).
Any ideas on getting MCU operational without intact p1/p2?
I just ran into the very same issue. p1 and p2 seem fine (they pass fsck) but getting squashfs errors and MCU refuses to come up. Did you resolve this?
 

whitex

Well-Known Member
Sep 30, 2015
6,825
8,671
Seattle area, WA
Anyone know how to extract a staged update to obtain a valid p1/p2 squashfs images? I got to my emmc a little late, and getting squashfs errors on boot, however there should be a staged update pending on the emmc (I assume p3 or p4). Can I use it to extract a valid firmware image?
 

whitex

Well-Known Member
Sep 30, 2015
6,825
8,671
Seattle area, WA
Just wanted to update this thread on my earlier comments about using Swissbit in pSLC/reliable mode. I used the 32GB EM-26 series (64GB part factory configured as pSLC) as a replacement and it worked just fine. Given that I didn't even expand the partitions beyond 8GB (didn't want to hack it, or worry what if Tesla assumed 8GB total and some update has a problem with that), this chip should outlive my car easily.
SwissbitOnTegra.jpg

Also, a quick note for those trying to recover their car keys from dead chips, I found 2 copies of them on my emmc chip - as individual file and another file called carkeys.tar which contained a copy of the same files. I can't be sure if that tar file exists on every car, but it did on mine. So, if your chips is dead and you're trying exotic methods to recover them, finding that tar file may be helpful to get some if not all the keys.
 
Last edited:

whitex

Well-Known Member
Sep 30, 2015
6,825
8,671
Seattle area, WA
I also verified that a 32GB EM-20 series Swissbit part configured as 16GB pSLC works in MCU1 as well. pSLC mode is known as the "reliable mode" and it was discussed earlier - it has 7x the program-erase cycles rating and it also yields faster performance (faster reads and writes).
 
Very nice and helpful thread. Just have few questions.

Is there more affordable emmc chip? The Swiss bit is pretty expensive, 58CAD per chip.
Did anyone have good experience using Easy Jtag programmer with tegra board?
Is there any way to keep MC in reset mode, to make sure, no files will be altered during read/write?
 

whitex

Well-Known Member
Sep 30, 2015
6,825
8,671
Seattle area, WA
Is there more affordable emmc chip? The Swiss bit is pretty expensive, 58CAD per chip.
You can use as small as 8GB chip, which should be cheaper, even in Swissbit line. Also, it's a standard eMMC interface so any BGA153 eMMC 4.0 or 5.0 should work (Tesla doesn't officially support swapping, so you take a risk, however small, trying a part nobody else has tried before). Is it really worth your time however to look for cheaper one and trying it, vs. using something you know has worked for others? Also, cheaper (and smaller) chips will give you lower expected lifetime (and therefore faster deterioration of performance). I guess only you can decide whether it's worth that. For me I went with Swissbit EM-26 32GB - highest reliability and performance part I could find, which is more than $58CAD (it costed me ~$70 USD), but that's because I wanted a solution so that I never have to worry about changing emmc chip again. Switching emmc chips is a lot of effort, and saving $30 is not worth to me having to have to do it again.

Is there any way to keep MC in reset mode, to make sure, no files will be altered during read/write?
If you don't keep it in reset, it's not the modified files you have to worry about, it's generally the bus contention by you and the MC accessing the bus a the same time.
 
Last edited:
  • Like
Reactions: .jg.

whitex

Well-Known Member
Sep 30, 2015
6,825
8,671
Seattle area, WA
It’s on 2019.40.2.3
That's an old version, no reported password locking. I was worried that maybe Tesla reacted to the recent media coverage of personal information leaks by finding some way to lock the emmc with a password, but for that version, you should be able to just read it. Not sure what makes EasyJTAG say the emmc is password locked. Are you sure you're trying to read the main MLC partition, and not RPMB or boot ones?
 
That's an old version, no reported password locking. I was worried that maybe Tesla reacted to the recent media coverage of personal information leaks by finding some way to lock the emmc with a password, but for that version, you should be able to just read it. Not sure what makes EasyJTAG say the emmc is password locked. Are you sure you're trying to read the main MLC partition, and not RPMB or boot ones?
I desoldered the emmc so the it should be isolated. the chip is h26m42001fmr. You just reminded me that i did brought my car to the service center for a quote on the repair. i don't think they did anything to lock the emmc though.
 

EV-Fixme

Member
Global Vendor
Oct 24, 2019
621
702
Orange County, CA
I desoldered the emmc so the it should be isolated. the chip is h26m42001fmr. You just reminded me that i did brought my car to the service center for a quote on the repair. i don't think they did anything to lock the emmc though.

I hope they are not implementing encryption. 2019.40 is pretty old, we've recovered plenty from that version. Never been prompted for a password for any MCU1 chip yet.

Also encrypting most older chips would probably kill them with all the additional writes.
 
  • Like
Reactions: StarLog

Products we're discussing on TMC...

About Us

Formed in 2006, Tesla Motors Club (TMC) was the first independent online Tesla community. Today it remains the largest and most dynamic community of Tesla enthusiasts. Learn more.

Do you value your experience at TMC? Consider becoming a Supporting Member of Tesla Motors Club. As a thank you for your contribution, you'll get nearly no ads in the Community and Groups sections. Additional perks are available depending on the level of contribution. Please visit the Account Upgrades page for more details.


SUPPORT TMC
Top